RE: [PATCH 1/3] libusbg: Fix readlink/buffer overrun issue. CID#56130, CID#56129

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

> -----Original Message-----
> From: Philippe De Swert [mailto:philippedeswert@xxxxxxxxx]
> 
> You mean something like this?
> 
> diff --git a/src/usbg.c b/src/usbg.c
> index 521513d..3774a6d 100644
> --- a/src/usbg.c
> +++ b/src/usbg.c
> @@ -843,14 +843,14 @@ static int
> usbg_parse_config_binding(usbg_config
> *c, char *bpath,
>   {
>          int nmb;
>          int ret;
> -       char target[USBG_MAX_PATH_LENGTH];
> +       char target[USBG_MAX_PATH_LENGTH + 1];
>          char *target_name;
>          const char *instance;
>          usbg_function_type type;
>          usbg_function *f;
>          usbg_binding *b;
> 
> -       nmb = readlink(bpath, target, sizeof(target));
> +       nmb = readlink(bpath, target, sizeof(target - 1));
I assume that you mean:

          nmb = readlink(bpath, target, sizeof(target) - 1 ); 

and this one above is just a typo;)

>          if (nmb < 0) {
>                  ret = usbg_translate_error(errno);
>                  goto out;
> @@ -859,7 +859,7 @@ static int
> usbg_parse_config_binding(usbg_config *c,
> char *bpath,
>          /* readlink() doesn't add this, so we have to do it
> manually,
>           * we need to take care to not overrun as readlink can
> return
>           * the maximum buffer and have a off-by-one error */
> -       target[nmb-1] = '\0';
> +       target[nmb] = '\0';
>          /* Target contains a full path
>           * but we need only function dir name */
>          target_name = strrchr(target, '/') + 1;
> 
> Make target bigger, avoid that readlink uses the full size and the
> same
> mistake happens with 4097 instead of 4096. Although just adding the
> byte
> seems a bit overkill to me.
> Maybe it is just better to read 4095 bytes so we have room for the
> '\0'.
> So only do nmb = readlink(bpath, target, sizeof(target - 1)); As I
> guess
> that the kernel uses a USBG_MAX_PATH_LENGTH of 4096 bytes which
> includes
> '\0'?

I have check the documentation in linux/limits.h and:

#define PATH_MAX        4096    /* # chars in a path name including nul
*/

So the solution you suggest sounds quite better than mine. Summing up,
we can use buffer which sizeof() is PATH_MAX and provide sizeof(target)
- 1 as max length to readlink().

--
BR's
Krzysztof Opasiak



--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux